First, we observe that adversarial training is the best performing method
and that unlike other methods, \(\operatorname{\mathbf {\ell }}_2\)  adversarial training helps for each corruption type.
At the same time, Gaussian augmentation degrades the performance on digital and weather corruptions while very significantly improving the performance for noise corruptions which is expected as the Gaussian noise used for training is also contained in the noise corruptions.
Interestingly, for the fog and contrast corruptions, the performance degrades for all methods (see Table REF  in App. ), consistently with the observation made in [1]}.
Our results also suggest that the impact of gradient regularization is limited and it cannot explain the accuracy gains of both adversarial training and Gaussian augmentation as one could expect from the fact that these methods are equivalent to gradient regularization when used with sufficiently small parameters \(\sigma \)  and \(\operatorname{\mathbf {\varepsilon }}\)  [2]}.
